Topic starter
02/08/2026 12:26 pm
TL;DR: Restaurant Brands International’s exposed APIs let attackers create tokens without authentication, escalate privileges, and access drive-thru audio and customer PII, while McDonald’s McHire separately exposed candidate data through insecure APIs, according to Salt. The pattern shows that API discovery, authentication, and runtime blocking now matter as much as perimeter security for identity-adjacent systems.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “Would You Like Data Leaks With That?”.
Key questions
Q: What breaks when APIs can mint tokens without authentication?
A: Authentication collapses when a public endpoint can issue valid tokens, because the session it creates looks legitimate to downstream systems.
Q: Why do exposed API keys often lead to privilege escalation instead of immediate data theft?
A: An exposed API key may not grant direct access to sensitive records, but it can provide an attacker with authenticated entry into a trusted environment.
Q: What are the signs that API visibility is failing in a production environment?
A: Common signs include delayed releases caused by unresolved API risks, low confidence in inventory accuracy, missing or outdated documentation, and production APIs exposing sensitive data without clear controls.
Practitioner guidance
- Map every externally reachable API and mutation path Build a complete inventory of customer-facing, workforce-facing, and internal APIs, including GraphQL schemas, hidden mutations, and forgotten endpoints.
- Require authentication before token issuance Block any create-token or session-minting flow unless identity is verified and the requested scope is explicitly authorised.
Bottom line: Exposed APIs can turn customer-facing and workforce-facing systems into direct breach paths when discovery, authentication, and authorization are weak.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:25 pm
API discovery has become an identity control problem, not just an application inventory problem. When attackers can find forgotten GraphQL endpoints, shadow APIs, or mutation paths, they are effectively mapping the organisation’s real access model. That makes API inventory part of governance over who and what can act on business systems. Practitioners should treat undiscovered APIs as unmanaged access paths, not mere technical debt.
A question worth separating out:
Q: Should teams prioritise API discovery or enforcement first?
A: Discovery comes first when shadow endpoints or incomplete inventories exist, because enforcement cannot protect what the team has not identified. Once the exposed surface is known, prioritise the most sensitive and most attacked APIs for schema validation, bot controls, and runtime enforcement.
👉 Read our full editorial: API exposure and zero-auth tokens are turning drive-thru systems into breach paths